test(mcp): add versioned exact contract guard

[barbatdev]

🔗 Linked Issue

Upstream issue: Gentleman-Programming#717 (status:approved).

This is a fork-first staging PR and intentionally does not close the upstream issue.

---

🏷️ PR Type

• type:bug — Bug fix
• type:feature — New feature
• type:docs — Documentation only
• type:refactor — Code refactoring (no behavior change)
• type:chore — Maintenance, dependencies, tooling
• type:breaking-change — Breaking change

---

📝 Summary

• Add the readable, versioned v1 baseline derived from the live MCP registry.
• Add canonical formatting, strict fixture reading, and an intermediate exact guard.
• Keep the registry as the sole runtime authority; the fixture remains test-only historical evidence.

📂 Changes

File	Change
internal/mcp/tool_contract_test.go	Adds canonical formatting, strict fixture-envelope reading, exact semantic comparison, and drift tests.
internal/mcp/testdata/tool-contract-v1.json	Adds the independently derived readable v1 baseline.

🧪 Test Plan

• Focused formatter, fixture-reader, and exact-guard tests pass.
• go test ./internal/mcp -count=1 passes with 88.8% package coverage.
• go build ./... passes.
• Ordinary tests preserve fixture bytes and SHA-256.
• go test ./... is fully green locally: two known macOS /var versus /private/var assertions fail outside internal/mcp.

Fixture evidence: 22 tools, 77 top-level properties, 23 required memberships, 205 lines, SHA-256 e4c6839c690c93247c7e9603c07bce66a1155136e79321748dba032b8e3007df.

---

🤖 Automated Checks

Fork-first note: the upstream issue is approved, but the fork-local governance job may not resolve an upstream issue through context.repo. The final upstream PR will use the canonical issue-closing reference.

---

✅ Contributor Checklist

• The approved upstream issue is linked above.
• Exactly one PR type and matching label are present.
• Commits follow conventional-commit format.
• No Co-Authored-By trailers are present.
• The exact delta is 397 additions plus 3 deletions across two paths.
• No runtime fixture dependency or production behavior is introduced.

---

💬 Notes for Reviewers

Fork-first stack, PR 2 of 3. PR 1 is already integrated into the fork base; this PR shows only its 400-line exact-guard delta. PR 3 replaces the conservative exact policy with directional compatibility and adds the guarded writer plus inventory de-duplication.